Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:918"
685 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-61970 |
medium | 4.9 | 0.0019 | 2026-07-13 | Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbna | |
CVE-2026-14646 |
medium | 4.9 | 0.0035 | 2026-07-14 | Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protections to HTTP | |
CVE-2026-62201 |
medium | 4.9 | 0.0036 | 2026-07-17 | OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec- | |
CVE-2026-62227 |
medium | 4.9 | 0.0039 | 2026-07-17 | OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser s | |
CVE-2026-54242 |
medium | 4.9 | 0.0023 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, | |
CVE-2026-65466 |
medium | 4.9 | 0.0019 | 2026-07-23 | Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. | |
CVE-2026-65467 |
medium | 4.9 | 0.0019 | 2026-07-23 | Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions. | |
CVE-2026-66437 |
medium | 4.9 | 0.0019 | 2026-07-27 | Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. | |
CVE-2026-33205 |
medium | 4.8 | 0.0018 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. | |
CVE-2026-0258 |
medium | 4.8 | 0.0033 | 2026-05-13 | A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks | |
CVE-2026-8661 |
medium | 4.8 | 0.0038 | 2026-06-26 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin o | |
CVE-2026-71569 |
medium | 4.8 | — | 2026-10-29 | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affect | |
CVE-2026-109681 |
medium | 4.7 | 0.0020 | 2026-10-20 | The FTP client trusts the server's PASV response IP:port without validation against the control conn | |
CVE-2026-109682 |
medium | 4.7 | 0.0017 | 2026-10-20 | Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to fol | |
CVE-2026-61529 |
medium | 4.7 | 0.0021 | 2026-10-28 | Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, th | |
CVE-2026-44661 |
medium | 4.7 | 0.0018 | 2026-05-14 | python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable | |
CVE-2026-0285 |
medium | 4.7 | 0.0043 | 2026-07-09 | A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an | |
CVE-2026-87897 |
medium | 4.6 | 0.0020 | 2026-10-27 | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can le | |
CVE-2026-58404 |
medium | 4.6 | 0.0037 | 2026-07-06 | Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls poli | |
CVE-2026-6812 |
medium | 4.4 | 0.0025 | 2026-05-02 | The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and | |
CVE-2026-42140 |
medium | 4.4 | 0.0018 | 2026-05-04 | PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2 | |
CVE-2026-13316 |
medium | 4.4 | 0.0015 | 2026-06-30 | A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and ht | |
CVE-2026-24639 |
medium | 4.4 | 0.0021 | 2026-07-23 | Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. | |
CVE-2026-65496 |
medium | 4.4 | 0.0021 | 2026-07-23 | Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions. | |
CVE-2026-4989 |
medium | 4.3 | 0.0017 | 2026-04-01 | Improper input validation in the gateway health check feature in Devolutions Server allows a low-pri | |
CVE-2026-41687 |
medium | 4.3 | 0.0020 | 2026-05-07 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the S | |
CVE-2026-42188 |
medium | 4.3 | 0.0019 | 2026-05-11 | Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a | |
CVE-2026-44441 |
medium | 4.3 | 0.0016 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, | |
CVE-2026-34170 |
medium | 4.3 | 0.0021 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-49856 |
medium | 4.3 | 0.0028 | 2026-08-13 | @jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security r | |
CVE-2026-54492 |
medium | 4.3 | 0.0041 | 2026-08-19 | Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible create | |
CVE-2026-104310 |
medium | 4.3 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitiv | |
CVE-2026-104315 |
medium | 4.3 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may | |
CVE-2026-67077 |
medium | 4.2 | 0.0012 | 2026-10-28 | HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an atta | |
CVE-2026-48522 |
medium | 4.2 | 0.0022 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argu | |
CVE-2026-39845 |
medium | 4.1 | 0.0027 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not util | |
CVE-2026-70591 |
medium | 4.1 | 0.0037 | 2026-08-04 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forger | |
CVE-2026-53945 |
medium | 4.0 | 0.0021 | 2026-06-24 | Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for | |
CVE-2026-70595 |
medium | 4.0 | 0.0028 | 2026-08-05 | Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed s | |
CVE-2026-70467 |
low | 3.8 | 0.0026 | 2026-08-12 | A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 thro | |
CVE-2026-44589 |
low | 3.7 | 0.0017 | 2026-05-14 | Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced | |
CVE-2026-53607 |
low | 3.7 | 0.0027 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4 | |
CVE-2026-12372 |
low | 3.7 | 0.0026 | 2026-08-09 | A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the curren | |
CVE-2026-48051 |
low | 3.5 | 0.0026 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's | |
CVE-2026-13233 |
low | 3.3 | 0.0021 | 2026-07-10 | Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Reques | |
CVE-2026-87953 |
low | 3.3 | 0.0017 | 2026-10-22 | Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Serve | |
CVE-2026-41488 |
low | 3.1 | 0.0016 | 2026-04-24 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchai | |
CVE-2026-12566 |
low | 3.1 | 0.0017 | 2026-06-17 | The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response h | |
CVE-2026-55807 |
low | 3.1 | 0.0022 | 2026-07-10 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Fo | |
CVE-2026-49262 |
low | 3.0 | 0.0017 | 2026-08-12 | In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy ro |